Detections
Analytics

SCA: security update for apache-superset (GHSA-f678-j579-4xf5)

high Tenable Self-Hosted Container Security Plugin ID 414315

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Improper authorization check and possible privilege escalation on Apache Superset up to but excluding
 2.1.2. Using the default examples database connection that allows access to both the examples schema and
 Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change
 data on the metadata database. This weakness could result on tampering with the
 authentication/authorization data. (CVE-2023-40610)

See Also

https://github.com/advisories/GHSA-f678-j579-4xf5

Plugin Details

Severity: High

ID: 414315

Version: Revision 1.18

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.79

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-40610

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/28/2023

Vulnerability Publication Date: 11/27/2023

Reference Information

CVE: CVE-2023-40610

cwe: CWE-863